diff mbox

spi: s3c64xx: Don't free controller_data on non-dt platforms

Message ID 1347546690-21848-1-git-send-email-s.nawrocki@samsung.com (mailing list archive)
State Superseded, archived
Headers show

Commit Message

When s3c64xx-spi is instantiated from device tree an instance of
struct s3c64xx_spi_csinfo is dynamically allocated in the driver.
For non-dt platform it is passed from board code through
spi_register_board_info(). On error path in s3c64xx_spi_setup()
function there is an attempt to free this data struct
s3c64xx_spi_csinfo object as it would have been allocated in the
driver for both, dt and non-dt based platforms. This leads to
following bug when gpio request fails:

spi spi1.0: Failed to get /CS gpio [21]: -16
kernel BUG at mm/slub.c:3478!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM
Modules linked in:
CPU: 0    Not tainted  (3.6.0-rc5-00092-g9b0b493-dirty #6111)
PC is at kfree+0x148/0x158
LR is at s3c64xx_spi_setup+0xac/0x290
pc : [<c00a513c>]    lr : [<c0227014>]    psr: 40000013
sp : ee043e10  ip : c032883c  fp : c0481f7c
r10: ee0abd80  r9 : 00000063  r8 : 00000000
r7 : ee129e78  r6 : ee104a00  r5 : fffffff0  r4 : c047bc64
r3 : 40000400  r2 : c047bc64  r1 : c04def60  r0 : 0004047b
Flags: nZcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
Control: 10c5387d  Table: 4000404a  DAC: 00000015
Process swapper/0 (pid: 1, stack limit = 0xee0422f0)
Stack: (0xee043e10 to 0xee044000)
...
[<c00a513c>] (kfree+0x148/0x158) from [<c0227014>] (s3c64xx_spi_setup+0xac/0x290)
[<c0227014>] (s3c64xx_spi_setup+0xac/0x290) from [<c02251a4>] (spi_setup+0x34/0x4c)
[<c02251a4>] (spi_setup+0x34/0x4c) from [<c02258d0>] (spi_add_device+0x98/0x128)
[<c02258d0>] (spi_add_device+0x98/0x128) from [<c02259d4>] (spi_new_device+0x74/0xa8)
[<c02259d4>] (spi_new_device+0x74/0xa8) from [<c0225a2c>] (spi_match_master_to_boardinfo+0x24/0x44)
[<c0225a2c>] (spi_match_master_to_boardinfo+0x24/0x44) from [<c0225b40>] (spi_register_master+0xf4/0x2a8)
[<c0225b40>] (spi_register_master+0xf4/0x2a8) from [<c043fe0c>] (s3c64xx_spi_probe+0x34c/0x42c)
[<c043fe0c>] (s3c64xx_spi_probe+0x34c/0x42c) from [<c01fc198>] (platform_drv_probe+0x18/0x1c)

There should be no attempt to kfree controller_data when it was
externally provided through the board code. Fix this by freeing
controller_data only when dev->of_node is not null.

Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
---
 drivers/spi/spi-s3c64xx.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--
1.7.11.3


------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/

Comments

Kim Kukjin Sept. 14, 2012, 4:27 a.m. UTC | #1
Sylwester Nawrocki wrote:
> 
> When s3c64xx-spi is instantiated from device tree an instance of
> struct s3c64xx_spi_csinfo is dynamically allocated in the driver.
> For non-dt platform it is passed from board code through
> spi_register_board_info(). On error path in s3c64xx_spi_setup()
> function there is an attempt to free this data struct
> s3c64xx_spi_csinfo object as it would have been allocated in the
> driver for both, dt and non-dt based platforms. This leads to
> following bug when gpio request fails:
> 
> spi spi1.0: Failed to get /CS gpio [21]: -16
> kernel BUG at mm/slub.c:3478!
> Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM
> Modules linked in:
> CPU: 0    Not tainted  (3.6.0-rc5-00092-g9b0b493-dirty #6111)
> PC is at kfree+0x148/0x158
> LR is at s3c64xx_spi_setup+0xac/0x290
> pc : [<c00a513c>]    lr : [<c0227014>]    psr: 40000013
> sp : ee043e10  ip : c032883c  fp : c0481f7c
> r10: ee0abd80  r9 : 00000063  r8 : 00000000
> r7 : ee129e78  r6 : ee104a00  r5 : fffffff0  r4 : c047bc64
> r3 : 40000400  r2 : c047bc64  r1 : c04def60  r0 : 0004047b
> Flags: nZcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
> Control: 10c5387d  Table: 4000404a  DAC: 00000015
> Process swapper/0 (pid: 1, stack limit = 0xee0422f0)
> Stack: (0xee043e10 to 0xee044000)
> ...
> [<c00a513c>] (kfree+0x148/0x158) from [<c0227014>]
> (s3c64xx_spi_setup+0xac/0x290)
> [<c0227014>] (s3c64xx_spi_setup+0xac/0x290) from [<c02251a4>]
> (spi_setup+0x34/0x4c)
> [<c02251a4>] (spi_setup+0x34/0x4c) from [<c02258d0>]
> (spi_add_device+0x98/0x128)
> [<c02258d0>] (spi_add_device+0x98/0x128) from [<c02259d4>]
> (spi_new_device+0x74/0xa8)
> [<c02259d4>] (spi_new_device+0x74/0xa8) from [<c0225a2c>]
> (spi_match_master_to_boardinfo+0x24/0x44)
> [<c0225a2c>] (spi_match_master_to_boardinfo+0x24/0x44) from [<c0225b40>]
> (spi_register_master+0xf4/0x2a8)
> [<c0225b40>] (spi_register_master+0xf4/0x2a8) from [<c043fe0c>]
> (s3c64xx_spi_probe+0x34c/0x42c)
> [<c043fe0c>] (s3c64xx_spi_probe+0x34c/0x42c) from [<c01fc198>]
> (platform_drv_probe+0x18/0x1c)
> 
> There should be no attempt to kfree controller_data when it was
> externally provided through the board code. Fix this by freeing
> controller_data only when dev->of_node is not null.
> 
> Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
> Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>

Yes, correct. Need to check it.

Acked-by: Kukjin Kim <kgene.kim@samsung.com>

Thanks.

Best regards,
Kgene.
--
Kukjin Kim <kgene.kim@samsung.com>, Senior Engineer,
SW Solution Development Team, Samsung Electronics Co., Ltd.


------------------------------------------------------------------------------
Got visibility?
Most devs has no idea what their production app looks like.
Find out how fast your code is with AppDynamics Lite.
http://ad.doubleclick.net/clk;262219671;13503038;y?
http://info.appdynamics.com/FreeJavaPerformanceDownload.html
Mark Brown Sept. 22, 2012, 4:12 p.m. UTC | #2
On Thu, Sep 13, 2012 at 04:31:30PM +0200, Sylwester Nawrocki wrote:
> When s3c64xx-spi is instantiated from device tree an instance of
> struct s3c64xx_spi_csinfo is dynamically allocated in the driver.

Applied, thanks.

------------------------------------------------------------------------------
How fast is your code?
3 out of 4 devs don\\\'t know how their code performs in production.
Find out how slow your code is with AppDynamics Lite.
http://ad.doubleclick.net/clk;262219672;13503038;z?
http://info.appdynamics.com/FreeJavaPerformanceDownload.html
diff mbox

Patch

diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c
index d1c8441f..7f75d4e 100644
--- a/drivers/spi/spi-s3c64xx.c
+++ b/drivers/spi/spi-s3c64xx.c
@@ -976,7 +976,8 @@  err_msgq:
 	spi_set_ctldata(spi, NULL);

 err_gpio_req:
-	kfree(cs);
+	if (spi->dev.of_node)
+		kfree(cs);

 	return err;
 }